You are viewing @bulleted.app’s public outline

This repository is larger than Bulleted indexes. Some bullets are missing. See what came loose.

1. Your session lives on the server now, behind a cookie that carries an identifier and nothing else. It used to carry your access token, your refresh token, and the key they are bound to
2. Reading a space on somebody else's server presents a credential minted for that space, rather than your own session token. A session token means nothing to a server that did not issue it, which is exactly why a space shared with somebody on another host would not open for them
3. Fixed: the credential exchange proves which key it is binding to instead of naming one. The space host stopped accepting a named key, and until this landed every cross-server space read answered "missing DPoP header" — a refusal that arrives before membership is ever considered, so it says nothing about the space
4. A private space hosted here was opened by an account on an independent server implementation — @chadtmiller.com's pds.js. His server minted the delegation token, ours minted the credential, and the two agreed: the first confirmed cross-server read of permissioned data in Bulleted
5. Fixed: a space's address opens the host's outline rather than your own, so a link to a shared space shows the page it was sent for
6. Fixed: zooming into a bullet inside a space stays inside the space, instead of dropping you onto the public plane
7. Fixed: a zoomed space page roots its subtree at the bullet you opened rather than at the space's key
8. Fixed: the long form of a space address renders the space instead of refusing it